{ config, pkgs, ... }:
{
  services.caddy = {
    enable = true;
    email  = "admin@srazka.com";

    # Generated app routes from the panel backend.
    extraConfig = ''
      import /var/lib/containers/routes/routes.caddy
    '';

    # Authelia's own login portal
    virtualHosts."auth.srazka.com".extraConfig = ''
      reverse_proxy 127.0.0.1:9091
    '';

    # Every protected site uses this snippet
    virtualHosts."hello.srazka.com".extraConfig = ''
      forward_auth 127.0.0.1:9091 {
        uri /api/authz/forward-auth
        copy_headers Remote-User Remote-Groups Remote-Email Remote-Name
      }
      reverse_proxy 192.168.100.11:80
    '';

    virtualHosts."panel.srazka.com".extraConfig = ''
      forward_auth 127.0.0.1:9091 {
        uri /api/authz/forward-auth
        copy_headers Remote-User Remote-Groups Remote-Email Remote-Name
      }
      reverse_proxy 127.0.0.1:9911
    '';
  };


  systemd.paths."caddy-routes-reload" = {
    wantedBy = [ "multi-user.target" ];
    pathConfig = {
      PathChanged = "/var/lib/containers/routes/routes.caddy";
    };
  };

  systemd.services."caddy-routes-reload" = {
    serviceConfig = {
      Type = "oneshot";
      ExecStart = "${pkgs.systemd}/bin/systemctl reload caddy.service";
    };
  };

}